scapy.fields

Fields: basic data structures that make up parts of packets.

class scapy.fields.ActionField(fld: Field[Any, Any], action_method: str, **kargs: Any)[source]

Bases: _FieldContainer

any2i(pkt: Packet | None, val: int) → Any[source]
fld
class scapy.fields.BCDFloatField(name: str, default: Any, fmt: str = 'H')[source]

Bases: Field[float, int]

i2m(pkt: Packet | None, x: float | None) → int[source]
m2i(pkt: Packet | None, x: int) → float[source]
class scapy.fields.BitEnumField(name: str, default: int | None, size: int, enum: Dict[int, str], **kwargs: Any)[source]

Bases: _BitField[List[int] | int], _EnumField[int]

any2i(pkt: Packet | None, x: Any) → List[int] | int[source]
i2repr(pkt: Packet | None, x: List[int] | int) → Any[source]
i2s: Dict[I, str] | None
i2s_cb: Callable[[I], str] | None
s2i: Dict[str, I] | None
s2i_cb: Callable[[str], I] | None
class scapy.fields.BitExtendedField(name: str, default: Any | None, extension_bit: int)[source]

Bases: Field[int | None, int]

Low E Bit Extended Field

This type of field has a variable number of bytes. Each byte is defined as follows: - 7 bits of data - 1 bit an an extension bit:

  • 0 means it is last byte of the field (“stopping bit”)

  • 1 means there is another byte after this one (“forwarding bit”)

To get the actual data, it is necessary to hop the binary data byte per byte and to check the extension bit until 0

addfield(pkt: Packet | None, s: bytes, val: int | None) → bytes[source]
extension_bit
getfield(pkt: Any | None, s: bytes) → Tuple[bytes, int | None][source]
class scapy.fields.BitField(name: str, default: I | None, size: int, tot_size: int = 0, end_tot_size: int = 0)[source]

Bases: _BitField[int]

Field to handle bits.

Parameters:

  • name – name of the field

  • default – default value

  • size – size (in bits). If negative, Low endian

  • tot_size – size of the total group of bits (in bytes) the bitfield is in. If negative, Low endian.

  • end_tot_size – same but for the BitField ending a group.

Example - normal usage:

 0                   1                   2                   3
 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|             A             |               B               | C |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

                         Fig. TestPacket

class TestPacket(Packet):
    fields_desc = [
        BitField("a", 0, 14),
        BitField("b", 0, 16),
        BitField("c", 0, 2),
    ]

Example - Low endian stored as 16 bits on the network:

x x x x x x x x x x x x x x x x
a [b] [   c   ] [      a      ]

Will first get reversed during dissecion:

x x x x x x x x x x x x x x x x
[      a        ] [b] [   c   ]

class TestPacket(Packet):
    fields_desc = [
        BitField("a", 0, 9, tot_size=-2),
        BitField("b", 0, 2),
        BitField("c", 0, 5, end_tot_size=-2)
    ]
class scapy.fields.BitFieldLenField(name: str, default: Optional[int], size: int, length_of: Optional[Union[Callable[[Optional[Packet]], int], str]]  # noqa: E501 = None, count_of: Optional[str] = None, adjust: Callable[[Optional[Packet], int], int]  # noqa: E501 = <function BitFieldLenField.<lambda>>, tot_size: int = 0, end_tot_size: int = 0)[source]

Bases: BitField

adjust
count_of
end_tot_size
i2m(pkt: Packet | None, x: Any | None) → int[source]
length_of
tot_size
class scapy.fields.BitLenEnumField(name: str, default: int | None, length_from: Callable[[Packet], int], enum: Dict[int, str], **kwargs: Any)[source]

Bases: BitLenField, _EnumField[int]

any2i(pkt: Packet | None, x: Any) → int[source]
i2repr(pkt: Packet | None, x: List[int] | int) → Any[source]
i2s: Dict[I, str] | None
i2s_cb: Callable[[I], str] | None
s2i: Dict[str, I] | None
s2i_cb: Callable[[str], I] | None
class scapy.fields.BitLenField(name: str, default: int | None, length_from: Callable[[Packet], int])[source]

Bases: BitField

addfield(pkt: Packet, s: Tuple[bytes, int, int] | bytes, val: int) → Tuple[bytes, int, int] | bytes[source]
getfield(pkt: Packet, s: Tuple[bytes, int] | bytes) → Tuple[Tuple[bytes, int], int] | Tuple[bytes, int][source]
length_from
class scapy.fields.BitMultiEnumField(name: str, default: int, size: int, enum: Dict[int, Dict[int, str]], depends_on: Callable[[Packet | None], int])[source]

Bases: _BitField[List[int] | int], _MultiEnumField[int]

any2i(pkt: Packet | None, x: Any) → List[int] | int[source]
depends_on
i2repr(pkt: Packet | None, x: List[int] | int) → str | List[str][source]
i2s: Dict[I, str] | None
i2s_cb: Callable[[I], str] | None
i2s_multi
s2i: Dict[str, I] | None
s2i_all: Dict[str, I]
s2i_cb: Callable[[str], I] | None
s2i_multi: Dict[I, Dict[str, I]]
class scapy.fields.BitScalingField(name: str, default: int, size: int, *args: Any, **kwargs: Any)[source]

Bases: _ScalingField, BitField

A ScalingField that is a BitField

class scapy.fields.BoundStrLenField(name: str, default: bytes, minlen: int = 0, maxlen: int = 255, length_from: Callable[[Packet], int] | None = None)[source]

Bases: StrLenField

maxlen
minlen
randval() → RandBin[source]
class scapy.fields.ByteEnumField(name: str, default: int | None, enum: Dict[int, str])[source]

Bases: EnumField[int]

class scapy.fields.ByteEnumKeysField(name: str, default: int | None, enum: Dict[int, str])[source]

Bases: ByteEnumField

ByteEnumField that picks valid values when fuzzed.

randval() → RandEnumKeys[source]
class scapy.fields.ByteField(name: str, default: int | None)[source]

Bases: Field[int, int]

class scapy.fields.CharEnumField(name: str, default: str, enum: Dict[str, str] | Tuple[Callable[[str], str], Callable[[str], str]], fmt: str = '1s')[source]

Bases: EnumField[str]

any2i_one(pkt: Packet | None, x: str) → str[source]
class scapy.fields.ConditionalField(fld: AnyField, cond: Callable[[Packet], bool])[source]

Bases: _FieldContainer

addfield(pkt: Packet, s: bytes, val: Any) → bytes[source]
any2i(pkt: Packet | None, x: Any) → Any[source]
cond
fld
getfield(pkt: Packet, s: bytes) → Tuple[bytes, Any][source]
i2h(pkt: Packet | None, val: Any) → Any[source]
class scapy.fields.DestField(name: str, default: str)[source]

Bases: Field[str, bytes]

classmethod bind_addr(layer: Type[Packet], addr: str, **condition: Any) → None[source]
bindings: Dict[Type[Packet], Tuple[str, Any]] = {<class 'scapy.layers.llmnr.LLMNRQuery'>: [('224.0.0.252', {'dport': 5355})], <class 'scapy.layers.llmnr.LLMNRResponse'>: [('224.0.0.252', {'dport': 5355})]}
defaultdst
dst_from_pkt(pkt: Packet) → str[source]
class scapy.fields.DestIP6Field(name: str, default: str)[source]

Bases: IP6Field, DestField

bindings: Dict[Type[Packet], Tuple[str, Any]] = {<class 'scapy.contrib.ospf.OSPFv3_Hdr'>: [('ff02::5', {})], <class 'scapy.layers.inet.UDP'>: [('ff02::fb', {'dport': 5353}), ('ff02::66', {'dport': 2029})], <class 'scapy.layers.llmnr.LLMNRQuery'>: [('FF02:0:0:0:0:0:1:3', {'dport': 5355})], <class 'scapy.layers.llmnr.LLMNRResponse'>: [('FF02:0:0:0:0:0:1:3', {'dport': 5355})]}
i2h(pkt: Packet | None, x: str | Net6 | None) → str[source]
i2m(pkt: Packet | None, x: str | Net6 | None) → bytes[source]
class scapy.fields.Emph(fld: Any)[source]

Bases: _FieldContainer

Empathize sub-layer for display

fld
class scapy.fields.EnumField(name: str, default: I | None, enum: Dict[I, str] | Dict[str, I] | List[str] | DADict[I, str] | Type[Enum] | Tuple[Callable[[I], str], Callable[[str], I]], fmt: str = 'H')[source]

Bases: _EnumField[I]

i2s: Dict[I, str] | None
i2s_cb: Callable[[I], str] | None
s2i: Dict[str, I] | None
s2i_cb: Callable[[str], I] | None
class scapy.fields.FCSField(*args: Any, **kwargs: Any)[source]

Bases: TrailerField

A FCS field that gets appended at the end of the packet (not layer).

fld
i2repr(pkt: Packet | None, x: int) → str[source]
class scapy.fields.Field(name: str, default: Any, fmt: str = 'H')[source]

Bases: Generic[I, M]

For more information on how this works, please refer to the ‘Adding new protocols’ chapter in the online documentation:

https://scapy.readthedocs.io/en/stable/build_dissect.html

addfield(pkt: Packet, s: bytes, val: I | None) → bytes[source]

Add an internal value to a string

Copy the network representation of field val (belonging to layer pkt) to the raw string packet s, and return the new string packet.

any2i(pkt: Packet | None, x: Any) → I | None[source]

Try to understand the most input values possible and make an internal value from them

copy() → Field[I, M][source]
default
do_copy(x: I) → I[source]
fmt
getfield(pkt: Packet, s: bytes) → Tuple[bytes, I][source]

Extract an internal value from a string

Extract from the raw packet s the field value belonging to layer pkt.

Returns a two-element list, first the raw packet string after having removed the extracted field, second the extracted field itself in internal representation.

h2i(pkt: Packet | None, x: Any) → I[source]

Convert human value to internal value

holds_packets = 0
i2count(pkt: Packet | None, x: I) → int[source]

Convert internal value to a number of elements usable by a FieldLenField. Always 1 except for list fields

i2h(pkt: Packet | None, x: I) → Any[source]

Convert internal value to human value

i2len(pkt: Packet, x: Any) → int[source]

Convert internal value to a length usable by a FieldLenField

i2m(pkt: Packet | None, x: I | None) → M[source]

Convert internal value to machine value

i2repr(pkt: Packet | None, x: I) → str[source]

Convert internal value to a nice representation

islist = 0
ismutable = False
m2i(pkt: Packet | None, x: M) → I[source]

Convert machine value to internal value

name
owners: List[Type[Packet]]
randval() → VolatileValue[Any][source]

Return a volatile object whose value is both random and suitable for this field

register_owner(cls: Type[Packet]) → None[source]
struct
sz: int
exception scapy.fields.FieldAttributeException[source]

Bases: Scapy_Exception

class scapy.fields.FieldLenField(name: str, default: Optional[Any], length_of: Optional[str] = None, fmt: str = 'H', count_of: Optional[str] = None, adjust: Callable[[Packet, int], int] = <function FieldLenField.<lambda>>)[source]

Bases: Field[int, int]

adjust
count_of
i2m(pkt: Packet | None, x: int | None) → int[source]
length_of
class scapy.fields.FieldListField(name: str, default: List[AnyField] | None, field: AnyField, length_from: Callable[[Packet], int] | None = None, count_from: Callable[[Packet], int] | None = None, max_count: int | None = None)[source]

Bases: Field[List[Any], List[Any]]

addfield(pkt: Packet, s: bytes, val: List[Any] | None) → bytes[source]
any2i(pkt: Packet | None, x: List[Any]) → List[Any][source]
count_from
field
getfield(pkt: Packet, s: bytes) → Any[source]
i2count(pkt: Packet | None, val: List[Any]) → int[source]
i2len(pkt: Packet, val: List[Any]) → int[source]
i2repr(pkt: Packet | None, x: List[Any]) → str[source]
islist = 1
length_from
max_count
exception scapy.fields.FieldValueRangeException[source]

Bases: Scapy_Exception

class scapy.fields.FixedPointField(name: str, default: int, size: int, frac_bits: int = 16)[source]

Bases: BitField

any2i(pkt: Packet | None, val: float | None) → int | None[source]
frac_bits
i2h(pkt: Packet | None, val: int | None) → EDecimal | None[source]
i2repr(pkt: Packet | None, val: int) → str[source]
class scapy.fields.FlagValue(value: List[str] | int | str, names: List[str] | str)[source]

Bases: object

copy() → FlagValue[source]
flagrepr() → str[source]
multi
names
value
class scapy.fields.FlagValueIter(flagvalue: FlagValue)[source]

Bases: object

cursor
flagvalue
next() → str[source]
class scapy.fields.FlagsField(name: str, default: int | FlagValue | None, size: int, names: List[str] | str | Dict[int, str], **kwargs: Any)[source]

Bases: _BitField[int | FlagValue | None]

Handle Flag type field

Make sure all your flags have a label

Example (list):
>>> from scapy.packet import Packet
>>> class FlagsTest(Packet):
        fields_desc = [FlagsField("flags", 0, 8, ["f0", "f1", "f2", "f3", "f4", "f5", "f6", "f7"])]  # noqa: E501
>>> FlagsTest(flags=9).show2()
###[ FlagsTest ]###
  flags     = f0+f3
Example (str):
>>> from scapy.packet import Packet
>>> class TCPTest(Packet):
        fields_desc = [
            BitField("reserved", 0, 7),
            FlagsField("flags", 0x2, 9, "FSRPAUECN")
        ]
>>> TCPTest(flags=3).show2()
###[ FlagsTest ]###
  reserved  = 0
  flags     = FS
Example (dict):
>>> from scapy.packet import Packet
>>> class FlagsTest2(Packet):
        fields_desc = [
            FlagsField("flags", 0x2, 16, {
                0x0001: "A",
                0x0008: "B",
            })
        ]
Parameters:

  • name – field’s name

  • default – default value for the field

  • size – number of bits in the field (in bits). if negative, LE

  • names – (list or str or dict) label for each flag If it’s a str or a list, the least Significant Bit tag’s name is written first.

any2i(pkt: Packet | None, x: Any) → FlagValue | None[source]
i2h(pkt: Packet | None, x: Any) → FlagValue | None[source]
i2repr(pkt: Packet | None, x: Any) → str[source]
ismutable = True
m2i(pkt: Packet | None, x: int) → FlagValue | None[source]
names
class scapy.fields.IEEEDoubleField(name: str, default: int | None)[source]

Bases: Field[int, int]

class scapy.fields.IEEEFloatField(name: str, default: int | None)[source]

Bases: Field[int, int]

class scapy.fields.IP6Field(name: str, default: str | None)[source]

Bases: Field[str | Net6 | None, bytes]

any2i(pkt: Packet | None, x: str | None) → str[source]
h2i(pkt: Packet | None, x: Any) → str[source]
i2h(pkt: Packet | None, x: str | Net6 | None) → str[source]
i2m(pkt: Packet | None, x: str | Net6 | None) → bytes[source]
i2repr(pkt: Packet | None, x: str | Net6 | None) → str[source]
m2i(pkt: Packet | None, x: bytes) → str[source]
randval() → RandIP6[source]
class scapy.fields.IP6PrefixField(name: str, default: Tuple[str, int], wordbytes: int = 1, length_from: Callable[[Packet], int] | None = None)[source]

Bases: _IPPrefixFieldBase

class scapy.fields.IPField(name: str, default: str | None)[source]

Bases: Field[str | Net, bytes]

any2i(pkt: Packet | None, x: Any) → Any[source]
h2i(pkt: Packet | None, x: AnyStr | List[AnyStr]) → Any[source]
i2h(pkt: Packet | None, x: str | Net | None) → str[source]
i2m(pkt: Packet | None, x: str | Net | None) → bytes[source]
i2repr(pkt: Packet | None, x: str | Net) → str[source]
m2i(pkt: Packet | None, x: bytes) → str[source]
randval() → RandIP[source]
resolve(x: str) → str[source]
class scapy.fields.IPPrefixField(name, default, wordbytes=1, length_from=None)[source]

Bases: _IPPrefixFieldBase

class scapy.fields.IntEnumField(name: str, default: int | None, enum: Dict[int, str])[source]

Bases: EnumField[int]

class scapy.fields.IntEnumKeysField(name: str, default: int | None, enum: Dict[int, str])[source]

Bases: IntEnumField

IntEnumField that picks valid values when fuzzed.

randval() → RandEnumKeys[source]
class scapy.fields.IntField(name: str, default: int | None)[source]

Bases: Field[int, int]

class scapy.fields.LE3BytesEnumField(name: str, default: int | None, enum: Dict[int, str])[source]

Bases: LEThreeBytesField, _EnumField[int]

any2i(pkt: Packet | None, x: Any) → int[source]
i2repr(pkt: Packet | None, x: Any) → List[str] | str[source]
i2s: Dict[I, str] | None
i2s_cb: Callable[[I], str] | None
s2i: Dict[str, I] | None
s2i_cb: Callable[[str], I] | None
class scapy.fields.LEFieldLenField(name: str, default: Optional[Any], length_of: Optional[str] = None, fmt: str = '<H', count_of: Optional[str] = None, adjust: Callable[[Packet, int], int] = <function LEFieldLenField.<lambda>>)[source]

Bases: FieldLenField

class scapy.fields.LEIntEnumField(name: str, default: int, enum: Dict[int, str])[source]

Bases: EnumField[int]

class scapy.fields.LEIntField(name: str, default: int | None)[source]

Bases: Field[int, int]

class scapy.fields.LELongEnumField(name: str, default: int, enum: Dict[int, str] | List[str])[source]

Bases: EnumField[int]

class scapy.fields.LELongField(name: str, default: int | None)[source]

Bases: LongField

class scapy.fields.LEMACField(name: str, default: Any | None)[source]

Bases: MACField

i2m(pkt: Packet | None, x: str | None) → bytes[source]
m2i(pkt: Packet | None, x: bytes) → str[source]
class scapy.fields.LEShortEnumField(name: str, default: int, enum: Dict[int, str] | List[str])[source]

Bases: EnumField[int]

class scapy.fields.LEShortField(name: str, default: int | None)[source]

Bases: Field[int, int]

class scapy.fields.LESignedIntField(name: str, default: int)[source]

Bases: Field[int, int]

class scapy.fields.LESignedLongField(name: str, default: Any | None)[source]

Bases: Field[int, int]

class scapy.fields.LESignedShortField(name: str, default: int | None)[source]

Bases: Field[int, int]

class scapy.fields.LEThreeBytesField(name: str, default: int | None)[source]

Bases: ByteField

addfield(pkt: Packet, s: bytes, val: int | None) → bytes[source]
getfield(pkt: Packet | None, s: bytes) → Tuple[bytes, int][source]
scapy.fields.LEX3BytesField(*args: Any, **kwargs: Any) → Any[source]
class scapy.fields.LSBExtendedField(name: str, default: Any | None)[source]

Bases: BitExtendedField

class scapy.fields.LenField(name: str, default: ~typing.Any | None, fmt: str = 'H', adjust: ~typing.Callable[[int], int] = <function LenField.<lambda>>)[source]

Bases: Field[int, int]

If None, will be filled with the size of the payload

adjust
i2m(pkt: Packet | None, x: int | None) → int[source]
class scapy.fields.LongEnumField(name: str, default: int, enum: Dict[int, str] | List[str])[source]

Bases: EnumField[int]

class scapy.fields.LongField(name: str, default: int)[source]

Bases: Field[int, int]

class scapy.fields.MACField(name: str, default: Any | None)[source]

Bases: Field[str | None, bytes]

any2i(pkt: Packet | None, x: Any) → str[source]
i2m(pkt: Packet | None, x: str | None) → bytes[source]
i2repr(pkt: Packet | None, x: str | None) → str[source]
m2i(pkt: Packet | None, x: bytes) → str[source]
randval() → RandMAC[source]
class scapy.fields.MSBExtendedField(name: str, default: Any | None)[source]

Bases: BitExtendedField

exception scapy.fields.MaximumItemsCount[source]

Bases: Scapy_Exception

class scapy.fields.MayEnd(fld: Any)[source]

Bases: _FieldContainer

Allow packet dissection to end after the dissection of this field if no bytes are left.

A good example would be a length field that can be 0 or a set value, and where it would be too annoying to use multiple ConditionalFields

Important note: any field below this one MUST default to an empty value, else the behavior will be unexpected.

fld
class scapy.fields.MultiEnumField(name: str, default: int, enum: Dict[I, Dict[I, str]], depends_on: Callable[[Packet | None], I], fmt: str = 'H')[source]

Bases: _MultiEnumField[int], EnumField[int]

depends_on
i2s_multi
s2i_all: Dict[str, I]
s2i_multi: Dict[I, Dict[str, I]]
class scapy.fields.MultiFlagsEntry(short, long)[source]

Bases: tuple

long

Alias for field number 1

short

Alias for field number 0

class scapy.fields.MultiFlagsField(name: str, default: Set[str], size: int, names: Dict[int, Dict[int, MultiFlagsEntry]], depends_on: Callable[[Packet | None], int])[source]

Bases: _BitField[Set[str]]

any2i(pkt: Packet | None, x: Any) → Set[str][source]
depends_on
i2m(pkt: Packet | None, x: Set[str] | None) → int[source]
i2repr(pkt: Packet | None, x: Set[str]) → str[source]
m2i(pkt: Packet | None, x: int) → Set[str][source]
names
class scapy.fields.MultipleTypeField(flds: List[Tuple[Field[Any, Any], Any, str] | Tuple[Field[Any, Any], Any]], dflt: Field[Any, Any])[source]

Bases: _FieldContainer

MultipleTypeField are used for fields that can be implemented by various Field subclasses, depending on conditions on the packet.

It is initialized with flds and dflt.

Parameters:

  • dflt – is the default field type, to be used when none of the conditions matched the current packet.

  • flds – is a list of tuples (fld, cond) or (fld, cond, hint) where fld if a field type, and cond a “condition” to determine if fld is the field type that should be used.

cond is either:

  • a callable cond_pkt that accepts one argument (the packet) and returns True if fld should be used, False otherwise.

  • a tuple (cond_pkt, cond_pkt_val), where cond_pkt is the same as in the previous case and cond_pkt_val is a callable that accepts two arguments (the packet, and the value to be set) and returns True if fld should be used, False otherwise.

See scapy.layers.l2.ARP (type “help(ARP)” in Scapy) for an example of use.

addfield(pkt: Packet, s: bytes, val: Any) → bytes[source]
any2i(pkt: Packet | None, val: Any) → Any[source]
default
dflt
property fld: Field[Any, Any]
flds
get_fields_list() → List[Any][source]
getfield(pkt: Packet, s: bytes) → Tuple[bytes, Any][source]
h2i(pkt: Packet | None, val: Any) → Any[source]
hints
i2h(pkt: Packet, val: Any) → Any[source]
i2len(pkt: Packet, val: Any) → int[source]
i2m(pkt: Packet | None, val: Any | None) → Any[source]
i2repr(pkt: Packet | None, val: Any) → str[source]
name
register_owner(cls: Type[Packet]) → None[source]
class scapy.fields.NBytesField(name: str, default: int | None, sz: int)[source]

Bases: Field[int, List[int]]

addfield(pkt: Packet | None, s: bytes, val: int | None) → bytes[source]
getfield(pkt: Packet | None, s: bytes) → Tuple[bytes, int][source]
i2m(pkt: Packet | None, x: int | None) → List[int][source]
i2repr(pkt: Packet | None, x: int) → str[source]
m2i(pkt: Packet | None, x: List[int] | int) → int[source]
randval() → RandNum[source]
class scapy.fields.NetBIOSNameField(name: str, default: bytes, length: int = 31)[source]

Bases: StrFixedLenField

h2i(pkt: Packet | None, x: bytes) → bytes[source]
i2m(pkt: Packet | None, y: bytes | None) → bytes[source]
m2i(pkt: Packet | None, x: bytes) → bytes[source]
class scapy.fields.OByteField(name: str, default: int | None)[source]

Bases: ByteField

i2repr(pkt: Packet | None, x: int) → str[source]
class scapy.fields.OUIField(name: str, default: int)[source]

Bases: X3BytesField

A field designed to carry a OUI (3 bytes)

i2repr(pkt: Packet | None, val: int) → str[source]
class scapy.fields.ObservableDict(*args: Dict[int, str], **kw: Any)[source]

Bases: Dict[int, str]

Helper class to specify a protocol extendable for runtime modifications

observe(observer: _EnumField[Any]) → None[source]
update(anotherDict)[source]
class scapy.fields.PacketField(name: str, default: Optional[K], pkt_cls: Union[Callable[[bytes], Packet], Type[Packet]]  # noqa: E501)[source]

Bases: _PacketFieldSingle[BasePacket]

randval() → Packet[source]
class scapy.fields.PacketLenField(name: str, default: Packet, cls: Union[Callable[[bytes], Packet], Type[Packet]]  # noqa: E501, length_from: Optional[Callable[[Packet], int]]  # noqa: E501 = None)[source]

Bases: _PacketFieldSingle[BasePacket | None]

getfield(pkt: Packet, s: bytes) → Tuple[bytes, BasePacket | None][source]
length_from
class scapy.fields.PacketListField(name: str, default: Optional[List[BasePacket]], pkt_cls: Optional[Union[Callable[[bytes], Packet], Type[Packet]]]  # noqa: E501 = None, count_from: Optional[Callable[[Packet], int]] = None, length_from: Optional[Callable[[Packet], int]] = None, next_cls_cb: Optional[Callable[[Packet, List[BasePacket], Optional[Packet], bytes], Type[Packet]]]  # noqa: E501 = None, max_count: Optional[int] = None)[source]

Bases: _PacketField[List[BasePacket]]

PacketListField represents a list containing a series of Packet instances that might occur right in the middle of another Packet field. This field type may also be used to indicate that a series of Packet instances have a sibling semantic instead of a parent/child relationship (i.e. a stack of layers). All elements in PacketListField have current packet referenced in parent field.

addfield(pkt: Packet, s: bytes, val: Any) → bytes[source]
any2i(pkt: Packet | None, x: Any) → List[BasePacket][source]
count_from
getfield(pkt: Packet, s: bytes) → Tuple[bytes, List[BasePacket]][source]
i2count(pkt: Packet | None, val: List[BasePacket]) → int[source]
i2len(pkt: Packet | None, val: List[Packet]) → int[source]
i2m(pkt: Packet | None, i: Any) → bytes[source]
islist = 1
length_from
max_count
next_cls_cb
class scapy.fields.PadField(fld: Field[Any, Any] | _FieldContainer, align: int, padwith: bytes | None = None)[source]

Bases: _FieldContainer

Add bytes after the proxified field so that it ends at the specified alignment from its beginning

addfield(pkt: Packet, s: bytes, val: Any) → bytes[source]
fld
getfield(pkt: Packet, s: bytes) → Tuple[bytes, Any][source]
padlen(flen: int, pkt: Packet) → int[source]
class scapy.fields.RawVal(val: bytes = b'')[source]

Bases: object

A raw value that will not be processed by the field and inserted as-is in the packet string.

Example:

>>> a = IP(len=RawVal("####"))
>>> bytes(a)
b'F\x00####\x00\x01\x00\x005\xb5\x00\x00\x7f\x00\x00\x01\x7f\x00\x00\x01\x00\x00'
class scapy.fields.ReversePadField(fld: Field[Any, Any] | _FieldContainer, align: int, padwith: bytes | None = None)[source]

Bases: PadField

Add bytes BEFORE the proxified field so that it starts at the specified alignment from its beginning

addfield(pkt: Packet, s: bytes, val: Any) → bytes[source]
fld
getfield(pkt: Packet, s: bytes) → Tuple[bytes, Any][source]
original_length(pkt: Packet) → int[source]
class scapy.fields.ScalingField(name: str, default: float, scaling: int | float = 1, unit: str = '', offset: int | float = 0, ndigits: int = 3, fmt: str = 'B')[source]

Bases: _ScalingField, Field[int | float, int | float]

Handle physical values which are scaled and/or offset for communication

Example

>>> from scapy.packet import Packet
>>> class ScalingFieldTest(Packet):
        fields_desc = [ScalingField('data', 0, scaling=0.1, offset=-1, unit='mV')]  # noqa: E501
>>> ScalingFieldTest(data=10).show2()
###[ ScalingFieldTest ]###
  data= 10.0 mV
>>> hexdump(ScalingFieldTest(data=10))
0000  6E                                               n
>>> hexdump(ScalingFieldTest(data=b"m"))
0000  6D                                               m
>>> ScalingFieldTest(data=b"m").show2()
###[ ScalingFieldTest ]###
  data= 9.9 mV

bytes(ScalingFieldTest(…)) will produce 0x6E in this example. 0x6E is 110 (decimal). This is calculated through the scaling factor and the offset. “data” was set to 10, which means, we want to transfer the physical value 10 mV. To calculate the value, which has to be sent on the bus, the offset has to subtracted and the scaling has to be applied by division through the scaling factor. bytes = (data - offset) / scaling bytes = ( 10 - (-1) ) / 0.1 bytes = 110 = 0x6E

If you want to force a certain internal value, you can assign a byte- string to the field (data=b”m”). If a string of a bytes object is given to the field, no internal value conversion will be applied

Parameters:

  • name – field’s name

  • default – default value for the field

  • scaling – scaling factor for the internal value conversion

  • unit – string for the unit representation of the internal value

  • offset – value to offset the internal value during conversion

  • ndigits – number of fractional digits for the internal conversion

  • fmt – struct.pack format used to parse and serialize the internal value from and to machine representation # noqa: E501

class scapy.fields.SecondsIntField(name: str, default: int, use_msec: bool = False, use_micro: bool = False, use_nano: bool = False)[source]

Bases: Field[float, int]

i2repr(pkt: Packet | None, x: float | None) → str[source]
use_micro
use_msec
use_nano
class scapy.fields.ShortEnumField(name: str, default: int, enum: Dict[int, str] | Dict[str, int] | Tuple[Callable[[int], str], Callable[[str], int]] | DADict[int, str])[source]

Bases: EnumField[int]

i2s: Dict[I, str] | None
i2s_cb: Callable[[I], str] | None
s2i: Dict[str, I] | None
s2i_cb: Callable[[str], I] | None
class scapy.fields.ShortEnumKeysField(name: str, default: int, enum: Dict[int, str] | Dict[str, int] | Tuple[Callable[[int], str], Callable[[str], int]] | DADict[int, str])[source]

Bases: ShortEnumField

ShortEnumField that picks valid values when fuzzed.

randval() → RandEnumKeys[source]
class scapy.fields.ShortField(name: str, default: int | None)[source]

Bases: Field[int, int]

class scapy.fields.SignedByteField(name: str, default: int | None)[source]

Bases: Field[int, int]

class scapy.fields.SignedIntEnumField(name: str, default: int | None, enum: Dict[int, str])[source]

Bases: EnumField[int]

class scapy.fields.SignedIntField(name: str, default: int)[source]

Bases: Field[int, int]

class scapy.fields.SignedLongField(name: str, default: int | None)[source]

Bases: Field[int, int]

class scapy.fields.SignedShortField(name: str, default: int | None)[source]

Bases: Field[int, int]

class scapy.fields.SourceIP6Field(name: str)[source]

Bases: IP6Field

i2h(pkt: Packet | None, x: str | Net6 | None) → str[source]
i2m(pkt: Packet | None, x: str | Net6 | None) → bytes[source]
class scapy.fields.SourceIPField(name: str)[source]

Bases: IPField

i2h(pkt: Packet | None, x: str | Net | None) → str[source]
i2m(pkt: Packet | None, x: str | Net | None) → bytes[source]
class scapy.fields.StrEnumField(name: str, default: bytes, enum: Dict[str, str] | None = None, **kwargs: Any)[source]

Bases: _StrEnumField, StrField

enum
class scapy.fields.StrField(name: str, default: I | None, fmt: str = 'H', remain: int = 0)[source]

Bases: _StrField[bytes]

class scapy.fields.StrFieldUtf16(name: str, default: I | None, fmt: str = 'H', remain: int = 0)[source]

Bases: StrField

any2i(pkt: Packet | None, x: str | None) → bytes[source]
h2i(pkt: Packet | None, x: str | None) → bytes[source]
i2h(pkt: Packet | None, x: bytes) → str[source]
i2repr(pkt: Packet | None, x: bytes) → str[source]
class scapy.fields.StrFixedLenEnumField(name: str, default: bytes, enum: Optional[Dict[str, str]] = None, length: Optional[int] = None, length_from: Optional[Callable[[Optional[Packet]], int]]  # noqa: E501 = None)[source]

Bases: _StrEnumField, StrFixedLenField

enum
class scapy.fields.StrFixedLenField(name: str, default: Optional[bytes], length: Optional[int] = None, length_from: Optional[Callable[[Packet], int]]  # noqa: E501 = None)[source]

Bases: StrField

addfield(pkt: Packet, s: bytes, val: bytes | None) → bytes[source]
getfield(pkt: Packet, s: bytes) → Tuple[bytes, bytes][source]
i2repr(pkt: Packet | None, v: bytes) → str[source]
length_from
randval() → RandBin[source]
class scapy.fields.StrFixedLenFieldUtf16(name: str, default: Optional[bytes], length: Optional[int] = None, length_from: Optional[Callable[[Packet], int]]  # noqa: E501 = None)[source]

Bases: StrFixedLenField, StrFieldUtf16

class scapy.fields.StrLenEnumField(name: str, default: bytes, enum: Dict[str, str] | None = None, **kwargs: Any)[source]

Bases: _StrEnumField, StrLenField

enum
class scapy.fields.StrLenField(name: str, default: bytes, length_from: Callable[[Packet], int] | None = None, max_length: Any | None = None)[source]

Bases: StrField

StrField with a length

Parameters:

  • length_from – a function that returns the size of the string

  • max_length – max size to use as randval

ON_WIRE_SIZE_UTF16 = True
getfield(pkt: Any, s: bytes) → Tuple[bytes, bytes][source]
length_from
max_length
randval() → RandBin[source]
class scapy.fields.StrLenFieldUtf16(name: str, default: bytes, length_from: Callable[[Packet], int] | None = None, max_length: Any | None = None)[source]

Bases: StrLenField, StrFieldUtf16

class scapy.fields.StrNullField(name: str, default: I | None, fmt: str = 'H', remain: int = 0)[source]

Bases: StrField

DELIMITER = b'\x00'
addfield(pkt: Packet, s: bytes, val: bytes | None) → bytes[source]
getfield(pkt: Packet, s: bytes) → Tuple[bytes, bytes][source]
i2len(pkt: Packet | None, x: Any) → int[source]
randval() → RandTermString[source]
class scapy.fields.StrNullFieldUtf16(name: str, default: I | None, fmt: str = 'H', remain: int = 0)[source]

Bases: StrNullField, StrFieldUtf16

DELIMITER = b'\x00\x00'
class scapy.fields.StrStopField(name: str, default: str, stop: bytes, additional: int = 0)[source]

Bases: StrField

additional
getfield(pkt: Packet | None, s: bytes) → Tuple[bytes, bytes][source]
randval() → RandTermString[source]
stop
class scapy.fields.ThreeBytesField(name: str, default: int)[source]

Bases: Field[int, int]

addfield(pkt: Packet, s: bytes, val: int | None) → bytes[source]
getfield(pkt: Packet, s: bytes) → Tuple[bytes, int][source]
class scapy.fields.TrailerBytes[source]

Bases: bytes

Reverses slice operations to take from the back of the packet, not the front

class scapy.fields.TrailerField(fld: Field[Any, Any])[source]

Bases: _FieldContainer

Special Field that gets its value from the end of the packet (Note: not layer, but packet).

Mostly used for FCS

addfield(pkt: Packet, s: bytes, val: int | None) → bytes[source]
fld
getfield(pkt: Packet, s: bytes) → Tuple[bytes, int][source]
class scapy.fields.UTCTimeField(name: str, default: int, use_msec: bool = False, use_micro: bool = False, use_nano: bool = False, epoch: Tuple[int, int, int, int, int, int, int, int, int] | None = None, strf: str = '%a, %d %b %Y %H:%M:%S %z', custom_scaling: int | None = None, fmt: str = 'I')[source]

Bases: Field[float, int]

custom_scaling
delta
epoch
i2m(pkt: Packet | None, x: float | None) → int[source]
i2repr(pkt: Packet | None, x: float) → str[source]
strf
use_micro
use_msec
use_nano
class scapy.fields.UUIDEnumField(name: str, default: int | None, enum: Any, uuid_fmt: int = 0)[source]

Bases: UUIDField, _EnumField[UUID]

any2i(pkt: Packet | None, x: Any) → UUID[source]
i2repr(pkt: Packet | None, x: UUID) → Any[source]
i2s: Dict[I, str] | None
i2s_cb: Callable[[I], str] | None
s2i: Dict[str, I] | None
s2i_cb: Callable[[str], I] | None
class scapy.fields.UUIDField(name: str, default: int | None, uuid_fmt: int = 0)[source]

Bases: Field[UUID, bytes]

Field for UUID storage, wrapping Python’s uuid.UUID type.

The internal storage format of this field is uuid.UUID from the Python standard library.

There are three formats (uuid_fmt) for this field type:

  • FORMAT_BE (default): the UUID is six fields in big-endian byte order, per RFC 4122.

    This format is used by DHCPv6 (RFC 6355) and most network protocols.

  • FORMAT_LE: the UUID is six fields, with time_low, time_mid and time_high_version in little-endian byte order. This doesn’t change the arrangement of the fields from RFC 4122.

    This format is used by Microsoft’s COM/OLE libraries.

  • FORMAT_REV: the UUID is a single 128-bit integer in little-endian byte order. This changes the arrangement of the fields.

    This format is used by Bluetooth Low Energy.

Note: You should use the constants here.

The “human encoding” of this field supports a number of different input formats, and wraps Python’s uuid.UUID library appropriately:

  • Given a bytearray, bytes or str of 16 bytes, this class decodes UUIDs in wire format.

  • Given a bytearray, bytes or str of other lengths, this delegates to uuid.UUID the Python standard library. This supports a number of different encoding options – see the Python standard library documentation for more details.

  • Given an int or long, presumed to be a 128-bit integer to pass to uuid.UUID.

  • Given a tuple:

    • Tuples of 11 integers are treated as having the last 6 integers forming the node field, and are merged before being passed as a tuple of 6 integers to uuid.UUID.

    • Otherwise, the tuple is passed as the fields parameter to uuid.UUID directly without modification.

      uuid.UUID expects a tuple of 6 integers.

Other types (such as uuid.UUID) are passed through.

FORMATS = (0, 1, 2)
FORMAT_BE = 0
FORMAT_LE = 1
FORMAT_REV = 2
any2i(pkt: Optional[Packet], x: Any  # noqa: E501) → UUID | None[source]
i2m(pkt: Packet | None, x: UUID | None) → bytes[source]
m2i(pkt: Packet | None, x: bytes) → UUID[source]
static randval() → RandUUID[source]
uuid_fmt
class scapy.fields.X3BytesField(name: str, default: int)[source]

Bases: ThreeBytesField, XByteField

i2repr(pkt: Packet | None, x: int) → str[source]
class scapy.fields.XBitField(name: str, default: I | None, size: int, tot_size: int = 0, end_tot_size: int = 0)[source]

Bases: BitField

i2repr(pkt: Packet | None, x: int) → str[source]
class scapy.fields.XByteEnumField(name: str, default: int | None, enum: Dict[int, str])[source]

Bases: ByteEnumField

i2repr_one(pkt: Packet | None, x: int) → str[source]
class scapy.fields.XByteField(name: str, default: int | None)[source]

Bases: ByteField

i2repr(pkt: Packet | None, x: int) → str[source]
class scapy.fields.XIntField(name: str, default: int | None)[source]

Bases: IntField

i2repr(pkt: Packet | None, x: int) → str[source]
class scapy.fields.XLE3BytesEnumField(name: str, default: int | None, enum: Dict[int, str])[source]

Bases: LE3BytesEnumField

class scapy.fields.XLE3BytesField(name: str, default: int | None)[source]

Bases: LEThreeBytesField, XByteField

i2repr(pkt: Packet | None, x: int) → str[source]
class scapy.fields.XLEIntField(name: str, default: int | None)[source]

Bases: LEIntField, XIntField

i2repr(pkt: Packet | None, x: int) → str[source]
class scapy.fields.XLELongField(name: str, default: int | None)[source]

Bases: LELongField, XLongField

i2repr(pkt: Packet | None, x: int) → str[source]
class scapy.fields.XLEShortField(name: str, default: int | None)[source]

Bases: LEShortField, XShortField

i2repr(pkt: Packet | None, x: int) → str[source]
class scapy.fields.XLEStrLenField(name: str, default: bytes, length_from: Callable[[Packet], int] | None = None, max_length: Any | None = None)[source]

Bases: XStrLenField

i2m(pkt: Packet | None, x: bytes | None) → bytes[source]
m2i(pkt: Packet | None, x: bytes) → bytes[source]
class scapy.fields.XLongField(name: str, default: int)[source]

Bases: LongField

i2repr(pkt: Packet | None, x: int) → str[source]
class scapy.fields.XNBytesField(name: str, default: int | None, sz: int)[source]

Bases: NBytesField

i2repr(pkt: Packet | None, x: int) → str[source]
class scapy.fields.XShortEnumField(name: str, default: int, enum: Dict[int, str] | Dict[str, int] | Tuple[Callable[[int], str], Callable[[str], int]] | DADict[int, str])[source]

Bases: ShortEnumField

class scapy.fields.XShortField(name: str, default: int | None)[source]

Bases: ShortField

i2repr(pkt: Packet | None, x: int) → str[source]
class scapy.fields.XStrField(name: str, default: I | None, fmt: str = 'H', remain: int = 0)[source]

Bases: _XStrField, StrField

StrField which value is printed as hexadecimal.

class scapy.fields.XStrFixedLenField(name: str, default: Optional[bytes], length: Optional[int] = None, length_from: Optional[Callable[[Packet], int]]  # noqa: E501 = None)[source]

Bases: _XStrField, StrFixedLenField

StrFixedLenField which value is printed as hexadecimal.

class scapy.fields.XStrLenField(name: str, default: bytes, length_from: Callable[[Packet], int] | None = None, max_length: Any | None = None)[source]

Bases: _XStrField, StrLenField

StrLenField which value is printed as hexadecimal.

class scapy.fields.YesNoByteField(name: str, default: int, config: Dict[str, Any] | None = None)[source]

Bases: ByteField

A byte based flag field that shows representation of its number based on a given association

In its default configuration the following representation is generated:

x == 0 : ‘no’ x != 0 : ‘yes’

In more sophisticated use-cases (e.g. yes/no/invalid) one can use the config attribute to configure. Key-value, key-range and key-value-set associations that will be used to generate the values representation.

  • A range is given by a tuple (<first-val>, <last-value>) including the last value.

  • A single-value tuple is treated as scalar.

  • A list defines a set of (probably non consecutive) values that should be associated to a given key.

All values not associated with a key will be shown as number of type unsigned byte.

For instance:

config = {
    'no' : 0,
    'foo' : (1,22),
    'yes' : 23,
    'bar' : [24,25, 42, 48, 87, 253]
}

Generates the following representations:

x == 0 : 'no'
x == 15: 'foo'
x == 23: 'yes'
x == 42: 'bar'
x == 43: 43

Another example, using the config attribute one could also revert the stock-yes-no-behavior:

config = {
        'yes' : 0,
        'no' : (1,255)
}

Will generate the following value representation:

x == 0 : 'yes'
x != 0 : 'no'
eval_fn
i2repr(pkt: Packet | None, x: int) → str[source]